2 ms·
It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. There are S
by Mountain_Skies 4y ago
It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. There are SLAs for how long the vendors can retain the source code they scan, but many clients are not aware of how much of these scans are performed manually behind the scenes by humans and how few of the vendors have their compliance audited. The possibility of a vendor failing to properly secure your source code is risky enough on its own, but it being accompanied by detailed reports of the security vulnerabilities in the code should cause some hair to stand on end.
- q-big 4y ago> It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. Write the source code in some Assembler language (or even binary code ;-) ). Or use some obscure programming language that the vendor cannot scan, thus having a reason not to upload it.
- Mountain_Skies 4y agoIn case you weren't being tongue in cheek, the purpose of the scan is to find security vulnerabilities so they can be rectified. If the scan cannot understand the code, it can't find the vulns that need remediation. Unfortunately, you don't even need to pick an obscure language. Almost all vendors of SAST products are chronically behind schedule on supporting the latest versions of languages and frameworks, and some of the biggest names have significant gaps in which commonly used languages they support.